Explain why an application page cannot open

Purpose

Deep links distinguish unavailable applications from missing authority within an available application.

How It Works

A person follows a page link whose availability may have changed. The route-body gate and page guard use the application answer before action authority. Different failures lead to different explanations. A generic unavailable page points toward home and the administrator’s overview. Settings and tools still rely on their individual page checks outside registered application paths. The product should pass a useful availability reason into the unavailable explanation when it can be sourced.

Relationships

Application access supplies enabled domains and permissions.
The Applications overview gives administrators a broader workspace explanation.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: A unavailable application receives a useful explanation.The person has a return destination from a blocked page.
Surfaces: console
Intent sources: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration (built and accepted by Andrew 2026-10-15)

Controls

23 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-IAM-001 TC-IAM-002 TC-IAM-004 TC-IAM-005 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

Key	Checked at	Scope
`console.access`	console	tenant
`configuration.applications.view`	console	tenant

Business Rules

8 rules, 6 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Proposed	When a page’s declared or permission-derived application is disabled, its guard shows application unavailability rather than permission denial. origin: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 2 (built and accepted by Andrew 2026-10-15) no proof recorded yet	policy	console	test react-console:lib/console/application-guard.test.ts#says the application is not available, not that access was denied
`02`must prove Proposed	Availability is evaluated before the page’s action permissions. origin: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 2 (built and accepted by Andrew 2026-10-15) no proof recorded yet	policy	console	test react-console:lib/console/application-guard.test.ts#prefers the application's answer: nobody can grant a permission inside an application they do not have
`03`must prove Proposed	A missing permission inside an enabled application renders Access Denied with a readable permission description and Back to Home. no proof recorded yet	permission	console	observed react-console:lib/authz/guard.tsx:RequirePermission, AccessDenied
`04`must prove Proposed	A declared application takes precedence over inferred applications; multiple inferred candidates need one enabled application and the page still requires a passing permission. no proof recorded yet	calculation	console	test react-console:lib/console/application-guard.test.ts#takes the domain a page names over the domain its permissions imply
`05`must prove Proposed	The route-body gate checks registry-owned application paths, including record descendants, only after the address workspace matches the current context. origin: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 2 (built and accepted by Andrew 2026-10-15) no proof recorded yet	policy	console	observed react-console:components/console/application-route-gate.tsx:ApplicationRouteGate
`06` Proposed	The unavailable page names the console application, explains administrator and Rhythm responsibilities, and offers Back to Home and View Applications.	policy	console	test react-console:e2e/mock/application-access.mock.spec.ts#a deep link into one of them says the application isn't available
`07` Proposed	Current route-gate callers omit the unavailability reason even though the Applications overview can display one.	policy	console	observed react-console:components/console/application-route-gate.tsx:ApplicationRouteGate
`08`must prove Proposed	A page declaring neither an application nor a permission passes the shared page decision. no proof recorded yet	validation	console	test react-console:lib/console/application-guard.test.ts#lets a page with no permission and no domain through

Scenarios

Id	Given	When	Then	Provenance
`01`	The workspace context omits Membership.	The person follows a Members link.	The body explains application unavailability and provides return links.	test react-console:e2e/mock/application-access.mock.spec.ts#a deep link into one of them says the application isn't available
`02`	The application is enabled but the person lacks the requested action key.	The page guard evaluates the destination.	It displays permission denial rather than application unavailability.	observed react-console:lib/authz/guard.tsx:RequirePermission, AccessDenied

Planning

Explain why an application page cannot open ​

Purpose ​

How It Works ​

Relationships ​